5588a89ac1c988ddabc5ae7cd44a696dc937bf7c03dfc6e78ff9edf16daaca0c

General

Target
2026-07-18_e1ba117a425a68ce0ca8536ea5ac6e11_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
Size 6.0MB
Sample260718-grxv8sdt21
SHA256 5588a89ac1c988ddabc5ae7cd44a696dc937bf7c03dfc6e78ff9edf16daaca0c
MD5 e1ba117a425a68ce0ca8536ea5ac6e11
SHA1 d2a519393b2ae0f0a93554e354e273ab349b0f88
SHA512 30d9ef0b22ad0c1f0900a268c84ad2b6db84453741aa375820836f937d72078049c28edba12f88b00c99d8a7f1c9cf503ac66dd18dcb48561ff44f79b1d3cc98
SSDEEP 98304:g0nAAYEpFhPhOo8NN+bClr/fRpm1WqaJnqRIn8:dN9hOo8NxHro/EqWn8
TLSH
T13E566D52E36250B8E45BC8B0CA1E553296357C4A43F096FF26D4BAF52A72ED43B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
412	original_temp.exe
1976	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\chromium_installer.log	original_temp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_e1ba117a425a68ce0ca8536ea5ac6e11_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 412	1836	2026-07-18_e1ba117a425a68ce0ca8536ea5ac6e11_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe	88
PID 412 wrote to memory of 1976	412	original_temp.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_e1ba117a425a68ce0ca8536ea5ac6e11_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_e1ba117a425a68ce0ca8536ea5ac6e11_akira_cobalt-strike_elex_icedid_njrat_quasar-rat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Users\Admin\AppData\Local\Temp\original_temp.exe
    C:\Users\Admin\AppData\Local\Temp\original_temp.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Chromium\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Chromium --annotation=ver=133.0.6928.0 --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff76498fce8,0x7ff76498fcf8,0x7ff76498fd08
    3⤵
    - Executes dropped EXE
    PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX1AC6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX1AC6.tmp
Size 1.1MB
SHA256 aa6fc38f5f12e86225891ad5e1ab9622ea42ef268ab7187a3c693252d2edf320
MD5 6d86b91c87e638ecfb66a7d72c1f3cdb
SHA1 fb6a3676d59f24fb4764d4ea9a11078e5e11867f
SHA512 f746d2fe75f309381b1562c09b548599fa474d5f67b2c4c96d13f2c15703c22a3ce4a96ded1acd26145bfe0f02609799ef48d7336a84754c4c10e16831b24d31
SSDEEP 24576:i7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6wYA+wix:x6F0eMpAAYEhprhhwK
TLSH
T190455C54E783C4F5FD2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX1DA7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX1DA7.tmp
Size 1.1MB
SHA256 1fd4e0510f113c182d441f2f476e7e86751119bb2a2be720a2ae82ed2e435cf9
MD5 f20f1dd236c6653423480f536eb67f7f
SHA1 c07d452728f10353939ec6be3f5e871f2e486506
SHA512 4bfb0054d787d32af0d6c9eda77c1736d7f549aee48c4a9b7aa3943f051e13678353709357734f887fab78b87179fcec1697dea7c630178c5f6105bf6a510423
SSDEEP 24576:i7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOIwYA+wMv:x6F0eMpAAYEhphhhwm
TLSH
T171455C54E783C4F5FD2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX1DB8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX1DB8.tmp
Size 1.1MB
SHA256 ce535b8508b0064c9c8e41d37d2587a46f80273333cc03327af64513ed5b4d99
MD5 448408c5bcb4ff59634f7d2cbdd60b36
SHA1 234d80dcf34818e83ce2e83adf9c92eb3a7f1f57
SHA512 6e3631fbe3910400bbf55ebe80470b37d54a2a302483a0fe5ad892b4e544877bc97e592eaecf96b785ba1a739ca5292aec12a9ffaf2839126950be925c5335b2
SSDEEP 24576:C7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOywYA+wip:R6F0eMpAAYEhpbhhwC
TLSH
T17A455C54E783C4F5FD2314F1444BEBFBA5309E1980318D6BFBC8EE11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 4.8MB
SHA256 b8cbbdaab265e6ea58fe0331152797e03bca5c284aa8a11556e6ea68e6340c6d
MD5 b06dc4e909f0dd18ab77dc8b4de38491
SHA1 e848db5948d68384dc4de38fe50e35b34de47f93
SHA512 e753337b902913aa8643c700dd2de3080e1d1e39cd89c43b47074f1408b1ecf75689736f884855f4fc84041c604f5c5abb1796df0cd51ea849486fd77700d37e
SSDEEP 49152:VOmfr/quPy22RBnNOPrF2S5Jz37TulYYM9wfI8padEYWnkXhY2Vsm0C9+qRIpJrL:VOo8NN+bClr/fRpm1WqaJnqRIn
TLSH
T169365B53A36610B8D46FC9B4CF29552296253C8A07F496FF22D47AF51A32ED43B38F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 5e7d12b80809a186967f9b76977cbaeed90982b373f49ed3fb1c16bf0ef2a3b4
MD5 63d2ad83e01870481fb6b6736b3b1a9e
SHA1 44f2bd22b39bd69e93266418d6134a3c99e2de64
SHA512 f65a00b08a432f510e2cea62689625c94a36944ec907aa1d77e01bb8fdab201b633da960fb14ca1f9e8d69eacc73595735cadebd0489c4764349d14e96eec710
SSDEEP 24576:i7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEwYA+wxl:x6F0eMpAAYEhpthhwz
TLSH
T119455C54E783C4F5FD2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1836-264-0x0000000000400000-0x0000000000532000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads